---
title: Microsoft Defender Integration for Security Exposure Management
description: The Microsoft Defender Integration for Security Exposure Management application is a unified integration point for importing security data from Microsoft TVM and Microsoft Defender for Cloud.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/ms-defender-sem.html
release: australia
product: Vulnerability Response
classification: vulnerability-response
topic_type: concept
last_updated: "2026-07-29"
reading_time_minutes: 2
breadcrumb: [Vulnerability Response integrations, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Microsoft Defender Integration for Security Exposure Management

The Microsoft Defender Integration for Security Exposure Management application is a unified integration point for importing security data from Microsoft TVM and Microsoft Defender for Cloud.

-   The Microsoft Defender Integration for Security Exposure Management application replaces the standalone Microsoft Defender for Cloud Integration for Security Operations application.
-   If you're upgrading from the standalone application, see [Migrate from the standalone Microsoft Defender for Cloud Integration to the Microsoft Defender Integration for Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/mstvm-migrate.md).

**Note:** The integrations support commercial cloud environments by default. If you require non-commercial support \(GCC High, DoD, etc.\), see the [Non-commercial configuration for Microsoft Defender Integration for Security Exposure Management](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3141167) Knowledge Base article \[KB3141167\] for more information.

The Microsoft Defender Integration for Security Exposure Management application bundles two independent integrations, each with its own configuration steps and distinct API URLs:

-   **Microsoft Threat and Vulnerability Management \(MS TVM\)**

    Imports vulnerability data, security recommendations, and asset information. Use this data to prioritize and remediate vulnerabilities across your environment. For configuration instructions, see [Understanding the Microsoft Threat and Vulnerability Management Vulnerability integrations for Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/mstvm-integration.md) and [Install and configure the Microsoft TVM integrations for Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/mstvm-install-and-configure.md).

-   **Microsoft Defender for Cloud**

    Imports cloud resource misconfigurations, security assessment findings, compliance assessment data, and container image vulnerabilities. Use this data to manage your cloud security posture. For configuration instructions, see [Understanding the Microsoft Defender for Cloud integrations for Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/cc_asc_overview.md) and [Install and configure Microsoft Defender for Cloud integrations for Security Exposure Management](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/cc_asc_install_configure.md).


To view the integrations included with this application, navigate to **All** > **Microsoft Defender Integration for USEM** > **Administration** > **Integrations**.